Loading...
GDPR anonymization runs first — before any analysis LLM sees your text. AES-256-GCM at rest. TLS 1.2+ in transit. No training on your content. And a 30-day hard-delete when you’re done.
This page is the full policy and the full security posture, laid out so you can read it in five minutes instead of fifty.
The legal entity that determines the purposes and means of processing under GDPR. The contact below is the route for any data-protection question, request, or complaint.
Every strategic memo is high-leverage data. These are the defaults you get from the moment you create an account. Not premium features, not paid add-ons.
Four stages between upload and rest. The most load-bearing is the second: anonymization happens before your text reaches any analysis model, not after.
The inverse list matters as much as the positive one. Every bullet below is a thing we will not do, by design and by policy.
If you are in the EEA, United Kingdom, or a jurisdiction with similar data-protection law, you can exercise any of these. We respond within 30 days.
If you're identified or referenced inside a strategic memo a Decision Intel customer uploaded, and that document's analysis bears on a decision that significantly affects you, GDPR Article 22 (and equivalent NDPR / PoPIA / UK GDPR provisions) gives you the right to obtain meaningful information about the logic involved, to express your point of view, and to contest the decision.
A separate lawful basis applies to each category of processing. Where the basis is legitimate interest, you have an unconditional right to object below.
Several of our sub-processors are US-headquartered. Where personal data of EEA, UK, Swiss, Nigerian, or South African residents is transferred outside their home jurisdiction, the transfer is covered by a recognised mechanism.
EEA → US transfersrely on the EU–US Data Privacy Framework (DPF) where the recipient is DPF-self-certified, or on the European Commission Standard Contractual Clauses (Module 2 / Module 3) backed by a documented Transfer Impact Assessment where it is not.
UK → US transfers rely on the UK International Data Transfer Addendum (IDTA) to the EU SCCs, and on the UK Extension to the DPF where applicable.
Nigeria → US transfers rely on NDPR-compliant data-transfer agreements with onward-transfer prohibitions, mirroring the GDPR-equivalent safeguards required by the NDPR 2019 Implementation Framework.
South Africa → US transfers rely on PoPIA s.72 with the recipient bound to a level of protection substantially similar to PoPIA via contractual safeguards.
Onward transfers are restricted by contract: each sub-processor is bound to the same protections we apply, and any addition triggers the 30-day prior-notice mechanism described in our Terms of Service. To request a copy of the active SCCs, IDTA, or sub-processor list, contact team@decision-intel.com.
These are the only external services your data touches. Each has a specific role, and each is contractually bound not to train on or resell your content.